Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 18 Mar 2015 15:12:07 +0300
From: Alexander Cherepanov <>
Subject: Re: Extend AFL to fuzz as you want

On 2015-03-15 02:55, Kai Zhao wrote:
>> XML is sure not convenient but it is powerful
> Sorry I forgot to describe why XML is powerful. XML can handle
> complex formats, such as 7z format. The 7z format is as follow:
> $7z$0$19$0$1122$8$d1f50227759415890000000000000000$1412385885$ data_length
> $112$ data
> The valid() function require  strlen(data) == data_length *  2.
> Complex hash formats like 7z can be handled with XML. But it's
> impossible for the expression like "$siemens-s7$1$%40h$%40h". I think
> the expression is good but it can handle complex hash format.
> If we want to fuzz valid(), the expression like
> "$siemens-s7$1$%40h$%40h" is ok. If we want to fuzz functions after
> valid(), the expression can not do that.

Neither bare XML nor scanf-like format strings can express such 
relations. But you can add support for it on top of both of them. E.g., 
add to format strings something like numbered groups from regexes:
"...$%1l%...$(%B)" where %1l means the length of the 1st group.

It's theoretically possible but I don't say that we should support it. I 
think that, for a start, we should review which building blocks we have 
in our hashes (hex, base64 etc.). Then we have to decide which we want 
to support. I'm leaning to the idea that we don't want to support such 
complex relations between parts of a hash at all.

I think this is a general question to be discussed in john-dev, not 
limited by the needs of fuzzing or security in general. Talking 
specifically about fuzzing, when you want to fuzz functions behind the 
valid() it's easier to patch this specific check out of valid() for now.

Alexander Cherepanov

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ